Privacy Policy

1. About this policy

FieldXM, Inc. ("FieldXM", "we", "us", "our") is a Delaware C corporation based in the United States. We are building a revenue-orchestration platform for in-person go-to-market. This policy explains how we handle personal information in connection with our website at https://www.fieldxm.com (the "Site"). The Site is a marketing site where prospective customers can learn about FieldXM and request a demo.

This policy covers people who visit the Site and people who submit our demo-request form. For that information, FieldXM is the controller. It also applies to users of the FieldXM product, but only for the information described in Section 9. When a customer uses the FieldXM product, FieldXM generally acts as a processor for the personal data that customer puts into the product about its own contacts and leads; that arrangement is described in Section 9.

Please read this policy to understand how we handle personal information. If you do not agree with it, please do not use the Site or submit the form. Your use of the Site is also governed by our Terms of Use. Your use of the FieldXM product is governed by the agreement between FieldXM and the customer whose account you use.

2. Information we collect

We collect a defined set of information, described below by category.

Information you give us through the demo-request form. The Site has one voluntary form. Its fields are:

• First name (required)
• Last name (required)
• Work email (required)
• Phone (required)
• Role or job title (required)
• Events per year: a selection from a fixed set of ranges (required)

The form includes this consent line: "By submitting this form, you opt in to receiving messages from FieldXM."

Completing the form is voluntary. The required fields are needed only so we can identify you and respond to your request. If you choose not to provide them, we will not be able to process your demo request, but this has no other consequence for you.

How your submission reaches us. The form is submitted to FieldXM through our own server endpoint, run by our hosting provider, which forwards your details to HubSpot Forms (HubSpot, Inc.), our customer-relationship-management provider. HubSpot, Inc. is based in the United States. If the submission cannot be completed, the form shows an error with our email address so you can send the same details to hello@fieldxm.com. Neither step sets cookies in your browser.

Technical data recorded automatically by our hosting provider. Our static hosting and content-delivery-network (CDN) provider may automatically record standard technical request data in its server logs, for example, your IP address, your browser or user-agent string, a timestamp, and the URL requested. This is kept for security, fraud prevention, and reliability. We do not use these logs for advertising or cross-site tracking.

How we collect it. We collect personal information directly from you, when you choose to fill in and submit the form, and automatically, through the technical server logs described above.

3. How we use your information

We use the information described above only for these purposes:

• To respond to your demo request and to communicate with you about it.
• To send you messages from FieldXM about our product and services, where you have opted in.
• To evaluate and arrange a potential customer relationship, including the steps leading up to any agreement.
• To operate, secure, and maintain the reliability of the Site, including preventing fraud and abuse.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

We do not use your personal information for solely automated decision-making that produces legal or similarly significant effects about you.

The purposes for the information we hold about users of the FieldXM product are stated in Section 9.

4. How we share and disclose information

We do not sell your personal information, and we share it only in the limited circumstances below.

Service providers, under contract. We use providers that handle information on our behalf and only on our instructions:

• HubSpot, Inc.: HubSpot Forms receives the details you submit (forwarded by our server endpoint), and we use HubSpot as our customer-relationship-management (CRM) tool to manage and respond to inquiries. HubSpot is based in the United States. If the submission cannot be completed, no data reaches HubSpot, and you can email the same details to us directly at hello@fieldxm.com.
• Our hosting / CDN provider: serves the Site, runs the serverless function that receives your form submission and forwards it to HubSpot, and maintains the technical server logs described in Section 2.

The providers that run the FieldXM product are described in Section 9.

Legal and safety disclosures. We may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our agreements; or to protect the rights, property, or safety of FieldXM, our users, or others.

Business transfers. If FieldXM is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction.

We do not sell or share for advertising. We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding 12 months.

5. Cookies and tracking technologies

The Site does not use non-essential cookies, and it does not set cookies that require your consent. For that reason the Site has no cookie-consent banner. No third party collects information about your activity across other websites through the Site.

Your light or dark mode choice. If you pick light or dark mode with the switch in the Site's header, your browser remembers that choice in its local storage (under the name fxm-theme) so the Site keeps it as you move between pages and when you come back. It holds only the word "light" or "dark". It is not a cookie, and it is not sent to us or to anyone else. Switching back to match your device's setting removes it, and so does clearing this site's data in your browser.

The form is sent to HubSpot without your browser's credentials, so that request does not set a cookie. If the form falls back to your own email application instead, no third-party request is made.

The web fonts used on the Site (Instrument Sans and JetBrains Mono) are self-hosted. We do not call Google Fonts or any other font service, so loading the Site does not send a font request to a third party.

6. Data retention and security

Retention. We keep the information you submit through the form for as long as we reasonably need it to respond to and evaluate your inquiry and to maintain our relationship with you. Where there is no active relationship and no legal reason to keep it, we aim to delete or anonymize inquiry data within 24 months of your last contact with us. Technical server logs are retained by our hosting provider only for as long as needed for security and reliability (typically days to a few weeks) and are then deleted in the ordinary course. Retention periods for the information we hold about users of the FieldXM product are stated in Section 9. We may keep information longer where the law requires it or where we need it to resolve a dispute or to enforce an agreement.

Security. We take reasonable technical and organizational measures to protect personal information, including encryption in transit. No method of transmission or storage is completely secure, and we cannot guarantee security.

7. International data transfers

FieldXM is based in the United States, and we and our service providers process information in the United States and in other countries where we or they operate.

8. Your privacy rights

Depending on where you live, you may have rights over your personal information. Where the law gives you the rights described below, we honor them, and we do not discriminate against you for exercising them.

If you are a California resident (CCPA/CPRA)

Over the preceding 12 months, the categories of personal information we have collected are identifiers (such as name, work email, and phone number), professional or employment-related information (such as company and role or job title), and internet or other electronic network activity information, meaning the technical server-log data described in Section 2 and, for users of the FieldXM product, the security records, diagnostic logs, and product usage data described in Section 9.

The sources of this information are you directly (the form, whether delivered through HubSpot or through your own email application, and the sign-in credentials you set in the FieldXM product), the customer that invites you to its FieldXM account, and your device or browser automatically (server logs, and the FieldXM product when you use it). We collect and use it for the business and commercial purposes described in Section 3 and Section 9 (responding to inquiries, sending opted-in messages, evaluating a potential customer relationship, securing the Site, and operating and securing the FieldXM product), and we disclose it only to the service providers and in the situations described in Section 4 and Section 9. We retain each category of personal information for the periods described in Section 6 (Data retention and security) and Section 9.

In the preceding 12 months, we disclosed identifiers, professional or employment-related information, and internet or other electronic network activity information to the service providers identified in Section 4 and Section 9 for the business purposes described in Section 3 and Section 9. We did not sell or share any category of personal information.

We do not sell your personal information and do not share it for cross-context behavioral advertising. Because we do not sell or share personal information, we do not provide a "Do Not Sell or Share My Personal Information" link, and no such opt-out mechanism is required. The only sensitive personal information we collect is the sign-in credentials of users of the FieldXM product. We use them to authenticate users and to secure the product. The right to limit does not apply to those uses, so we do not provide a "Limit the Use of My Sensitive Personal Information" link. If you are a California resident and the CCPA applies to our processing of your personal information, you have the right to:

• Know and access the personal information we have collected about you.
• Delete the personal information we have collected from you.
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information (not applicable here, because we do not sell or share it).
• Limit the use of sensitive personal information (not applicable here, because we use sign-in credentials only to authenticate users and secure the product).
• Non-discrimination for exercising your rights.
• Use an authorized agent to submit a request on your behalf, subject to verification.

How to exercise your rights. To make any request, email us at privacy@fieldxm.com. To protect your information, we will take reasonable steps to verify your identity before acting (typically by confirming details associated with your inquiry), and we may decline a request we cannot reasonably verify. Where a request is made by an authorized agent, we may require proof of the agent's authorization to act on your behalf and may still verify your identity directly. We will respond within the timeframes required by applicable law.

9. Our roles for data in the FieldXM product

This section describes how we handle personal data in the FieldXM product. It covers the data that customers put into the product and the information we hold about the product's users. The Site itself does not process customer-uploaded data.

When you use the FieldXM product as a customer, you may input or generate personal data about your own contacts and leads. For that data, you (the customer) are the controller, and FieldXM acts as a processor and handles the data on your documented instructions, including under a Data Processing Agreement (DPA) where we have one with you. We also process that data for our own purposes where this policy says so. Those purposes are keeping the product secure, understanding and improving the product, and complying with law. Our customers are responsible for providing any notices and obtaining any permissions needed for the information they put into the product, including for the conversations they record. If a customer has entered information about you into the product, please direct requests about that information to the customer. We will pass requests we receive to the customer. We use providers in categories such as cloud infrastructure, data storage, email delivery, speech transcription, AI model inference, and data enrichment to run the product. To request our current sub-processor list, or to ask about a DPA, contact privacy@fieldxm.com.

Aggregated and de-identified information. We may create aggregated or de-identified information from the information we hold and use it for any lawful purpose. We keep that information in de-identified form and do not try to re-identify it. We require anyone we share it with to do the same.

Audio and transcripts. Audio recorded through the product is deleted after it has been transcribed and the transcript has been processed. Audio that is not processed is deleted after 24 hours. We do not use customer audio or transcripts to train models.

The FieldXM mobile app uses the camera, microphone, and photo library only when you use the features that need them. What you capture with them is the customer's data and is handled as described above.

Account details and security records. If you use the FieldXM product as a user on a customer's account, we hold your account details. These are your name, work email address, role, and sign-in credentials. The administrator on the customer's account who invites you gives us your name, work email address, and role. You set your own sign-in credentials. We also keep a log of security events on the customer's account. The events logged are sign-ins, password resets, invitations and their acceptance, changes to a user's role or access, removal of a user, and data exports. Each entry records the user who performed the action, the user the action concerned, the time of the event, and the IP address from which the request was made. Administrators and managers on the customer's account can view these records in the product. We use these records to keep the product secure and to investigate suspected unauthorized access. We also use them to answer security questions from our customers. We use your account details to send you messages about your account and the operation of the product. Where the law allows, we may also tell you about related FieldXM products and services, and you can opt out of those messages at any time. We also use the information we hold about users to comply with law, to enforce our agreements, and to prevent misuse of the product. We delete each entry 180 days after the event. We keep your account details while you have access to the customer's account. After your access is removed, we keep them for as long as the security records that refer to them are kept. FieldXM is the controller of the account details and security records described in this paragraph. If your account is managed by a customer, we may refer a request about your account to that customer. The providers described in this section run the product and hold these records on our behalf.

Recording disclosure acknowledgments. When you acknowledge the recording disclosure in the product before recording at an event, we keep a record of that acknowledgment. We keep these records for as long as we need them to show that the disclosure was made and to respond to legal claims.

Diagnostic logs. The FieldXM mobile app sends us logs about its own operation, with the app version, the device model, and the operating system version. We use them to find and fix problems in the app. We delete them 14 days after we receive them.

Product usage data. We record how users interact with the FieldXM product, such as the pages viewed and the features used, together with your user ID, the customer account, and your role. We also record sessions in the product as a replay of the screens shown to you. Text typed into fields is masked in these recordings. We use this information to understand how the product is used and to improve it. We run the analytics software on infrastructure we control. We keep usage events and session recordings for as long as we need them for these purposes.

Copies of product data in our backups are deleted within 90 days after the data is changed or deleted in our production systems.

10. Children's privacy

The Site and the FieldXM product are intended for business users and are not directed to children. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected such information, we will delete it. If you believe a child has provided us with personal information, please contact us at privacy@fieldxm.com.

11. Third-party links

The Site may contain links to third-party websites or services that we do not operate. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site you visit.

12. Changes to this policy

We may update this policy from time to time. When we do, we will post the updated policy here and revise the effective date above.

13. How to contact us

FieldXM, Inc. is a Delaware corporation based in the United States. For privacy questions or to exercise your rights, contact privacy@fieldxm.com. For general inquiries, contact hello@fieldxm.com.